CVE-2010-0293

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-02-08 · updated 2026-06-16
Weakness: CWE-399

Description

The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.

Affected products

chrony: through 1.23-pre1; 1.18, 1.19, 1.19-1, 1.19.99.1, 1.19.99.2, 1.19.99.3 (+4)

References

http://chrony.tuxfamily.org/News.html
http://git.tuxfamily.org/chrony/chrony.git/?p=gitroot/chrony/chrony.git%3Ba=commit%3Bh=2f63cf448560fdb96b80d8488aae6a15b802a753
http://secunia.com/advisories/38428
http://secunia.com/advisories/38480
http://www.debian.org/security/2010/dsa-1992
http://www.securityfocus.com/bid/38106
https://bugzilla.redhat.com/show_bug.cgi?id=555367
http://chrony.tuxfamily.org/News.html
http://git.tuxfamily.org/chrony/chrony.git/?p=gitroot/chrony/chrony.git%3Ba=commit%3Bh=2f63cf448560fdb96b80d8488aae6a15b802a753
http://secunia.com/advisories/38428
http://secunia.com/advisories/38480
http://www.debian.org/security/2010/dsa-1992

Get alerted when CVE-2010-0293 or the next vulnerability affects your stack